OttoKit: Unauthenticated Privilege Escalation to Administrator

Threat Overview

A critical authentication flaw in OttoKit—the popular workflow automation plugin formerly known as SureTriggers, installed on over 100,000 WordPress installations—permits unauthenticated remote actors to gain immediate administrator privileges. Tracked as CVE-2025-27007 with a CVSS 9.8 severity score, the vulnerability allows remote attackers to bypass API key validation and remotely dispatch administrative user creation calls through the REST API, achieving total control over vulnerable websites.

The Breakdown: How the Exploit Works

The vulnerability stems from flawed cryptographic verification logic inside the plugin’s create_wp_connection() endpoint handler.

OttoKit exposes REST API routes intended to synchronize workflows between local WordPress installations and cloud automation services. When establishing an initial connection, the plugin verifies incoming connection tokens. However, on installations where native WordPress Application Passwords have not been explicitly configured or initialized, the verification handler defaults to an insecure state.

An unauthenticated attacker can forge an automation setup handshake, generate a valid session state, and dispatch unauthenticated calls to /wp-json/sure-triggers/v1/automation/action. By dispatching a create_user_if_not_exists event with administrator role parameters, the attacker forces WordPress to generate a rogue administrator account with attacker-controlled login credentials, completely bypassing standard authentication barriers.

The Operational Risk: What an Attacker Gains

Because automation plugins maintain deep administrative hooks into core WordPress functions, this exploit results in instantaneous and total compromise:

• Covert Administrator Injection: Threat actors create persistent admin users without triggering typical new user registration emails or administrative notifications.
• Complete Website Hijacking: Once logged in as an administrator, attackers edit theme files, install backdoored plugins, siphon customer data, and deface public pages.

Our Take in Plain English

“Connecting third-party automation tools to a monolithic CMS introduces dangerous API backdoors into production databases. When a plugin exposes an administrative user-creation hook to the public internet, a single logical verification error hands the keys of the entire kingdom to unauthenticated visitors. On a decoupled modern architecture, user administration and public content delivery are completely separated, preventing public API routes from modifying server privileges.”

The Modern Architectural Remedy

• Legacy Dynamic WordPress: Exposes administrative REST API endpoints and user-creation handlers on the public-facing domain, leaving authentication logic vulnerable to remote bypass.
• Modern Pre-Rendered Architecture: Delivers pre-compiled static pages to visitors while managing administrative workflows across isolated, zero-trust cloud infrastructure with no public user-creation endpoints.

Immediate Action Items for WordPress Operators

1. Update OttoKit Immediately: Update the plugin to version 1.0.77 or higher across all managed sites.
2. Audit Administrative Users: Review all user accounts in wp-admin > Users with the Administrator role and revoke any unrecognized accounts.
3. Restrict REST Endpoints: Block public external access to /wp-json/sure-triggers/ routes at your web application firewall unless verified by explicit IP allowlists.